Known Vulnerabilities for products from Concretecms
Listed below are 20 of the newest known vulnerabilities associated with the vendor "Concretecms".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-87031 json | n Concrete CMS 9.2.0 through 9.5.3, the REST API user creation endpoint (POST /ccm/api/1.0/users, the add() method of concret... | Not Provided | 2026-09-16 | 2026-09-21 |
| CVE-2026-87028 json | Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the custom-slot preview endpoint belonged... | Not Provided | 2026-09-16 | 2026-09-21 |
| CVE-2026-85387 json | Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the state of... | Not Provided | 2026-09-16 | 2026-09-21 |
| CVE-2026-85386 json | Concrete CMS before 9.5.4 did not sanitize XML and XSLT documents uploaded through a public Form Block file-upload question. ... | Not Provided | 2026-09-16 | 2026-09-21 |
| CVE-2026-85385 json | Concrete CMS below 9.5.4 did not validate the user timezone value (uTimezone) on write and rendered it without output encodin... | Not Provided | 2026-09-16 | 2026-09-21 |
| CVE-2026-81927 json | Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was... | Not Provided | 2026-09-15 | 2026-09-18 |
| CVE-2026-81926 json | Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-... | Not Provided | 2026-09-15 | 2026-09-21 |
| CVE-2026-81925 json | Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, res... | Not Provided | 2026-09-15 | 2026-09-21 |
| CVE-2026-81924 json | Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in the theme page-template activation feature. T... | Not Provided | 2026-09-15 | 2026-09-21 |
| CVE-2026-81923 json | In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving. The... | Not Provided | 2026-09-15 | 2026-09-18 |
| CVE-2026-81922 json | Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitem... | Not Provided | 2026-09-15 | 2026-09-18 |
| CVE-2026-81921 json | Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which ... | Not Provided | 2026-09-15 | 2026-09-18 |
| CVE-2026-81920 json | Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. The reset() c... | Not Provided | 2026-09-15 | 2026-09-18 |
| CVE-2026-81919 json | Concrete CMS below 9.5.3 did not validate an anti-CSRF token on the block-arrangement backend endpoint (the arrange() action ... | Not Provided | 2026-09-15 | 2026-09-18 |
| CVE-2026-81918 json | Concrete CMS below 9.5.3 is vulnerable to Stored XSS via the Date Format field in the Page Attribute Display block. A user wi... | Not Provided | 2026-09-11 | 2026-09-18 |
| CVE-2026-81917 json | Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Docum... | Not Provided | 2026-09-11 | 2026-09-18 |
| CVE-2026-81916 json | Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry submission against the entity of the posted ... | Not Provided | 2026-09-11 | 2026-09-18 |
| CVE-2026-81911 json | Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The custom_slot save_template e... | Not Provided | 2026-09-11 | 2026-09-18 |
| CVE-2026-81910 json | Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style... | Not Provided | 2026-09-11 | 2026-09-16 |
| CVE-2026-81903 json | Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container icon value submitted through the dashboard without validating ... | Not Provided | 2026-09-14 | 2026-09-18 |